一句话：提出首个能测试 JS 与 WebAssembly 交互的模糊测试器 Mad-Eye，发现 21 个未知漏洞。
JavaScript 引擎是现代浏览器的核心组件，已有大量模糊测试工作致力于提升其安全性。然而，WebAssembly 被引入 JavaScript 引擎后带来了新的攻击面，却未受到足够关注；现有 JavaScript 引擎模糊测试器主要针对 JavaScript，忽略了 WebAssembly 代码及其与 JavaScript 的交互。本文提出 Mad-Eye，这是首个采用跨语言代码融合技术来测试 JavaScript-WebAssembly 交互的模糊测试器。作者在 V8、SpiderMonkey 和 JavaScriptCore 三个主流引擎上评估了 Mad-Eye，共检测出 21 个此前未知的漏洞，其中 20 个得到确认，18 个已被修复并合并到主流浏览器中，开发者认可了这些报告并发放了漏洞赏金。
JavaScript engines are a fundamental part of modern browsers, and many efforts have been invested in testing them to enhance their security. However, the incorporation of WebAssembly into JavaScript engines introduces new attack surfaces that have not received sufficient attention. Existing fuzzers for JavaScript engines primarily focus on JavaScript, neglecting WebAssembly code and its interactions with JavaScript. We introduce Mad-Eye, the first fuzzer that can test the JavaScript-WebAssembly interaction using a novel cross-language code fusion technique. Evaluations of Mad-Eye on V8, SpiderMonkey, and JavaScriptCore detected 21 previously unknown vulnerabilities, with 20 confirmed and 18 fixed and merged into mainstream browsers by the developers, who acknowledged our reports with vulnerability bounties.
@inproceedings{paperbot11761,
title = {Fuzzing JavaScript Engines by Fusing JavaScript and WebAssembly},
author = {Jiayi Lin and Changhua Luo and Mingxue Zhang and Lanteng Lin and Penghui Li and Chenxiong Qian},
booktitle = {ICSE},
year = {2026},
doi = {10.1145/3744916.3764551}
}